shred — Secure file erasure

Linux / File and disk management / shred.html

A coreutils tool that overwrites a file repeatedly to make recovery difficult.

Basic Information

What is this command?

shred overwrites a file with random data several times before removing it. Unlike plain rm it aims to leave fewer traces on the disk.

On journaling file systems, SSDs and snapshot volumes the overwritten location may not be the physical block, so erasure is not guaranteed. Full-disk encryption is more reliable in those environments.

What problems does it solve?

• You must erase a sensitive file beyond recovery
• A script needs to wipe temporary files
• You want to overwrite a file with zeros
• You need to control the number of overwrite passes

Key features

Repeated overwrite

-n sets the number of passes (3 by default).

• When to use: Right before deleting sensitive data
• What you get: An overwritten, removed file
• Limitations: Wear leveling limits the effect on SSDs.

Overwrite with zeros

-z adds a final zero pass to hide patterns.

• When to use: You do not want to leave an overwrite pattern
• What you get: A zero-filled then removed file
• Limitations: A dedicated tool suits whole disks better.

Remove after overwriting

-u actually unlinks the file after overwriting.

• When to use: You want overwrite and delete in one step
• What you get: A file removed from the directory
• Limitations: An interrupted run can leave the file behind.

Installation and usage

Check whether it is installed

shred --version

sudo apt install coreutils # Debian/Ubuntu sudo dnf install coreutils # Fedora

Real-world examples

Overwrite then remove

Overwrite 7 times, add a zero pass, then delete.

shred -n 7 -z -u secret.key

Whole-disk overwrite warning

Pointing it at a device destroys all data, so verify the target first.

lsblk
# destructive: overwrite the whole device only after confirming the name
shred -n 1 -z /dev/sdb